Splunk Search

Search strings which are not starting with ****

kmmanu
New Member

Tthere are logs like below three lines

user name is "fgt56wer"
user name is "****89g4ty5"
user name is "jks4qw"

I want to avoid all lines which starts with user name is "**** from the splunk search result
My expected search output is below :-

user name is "fgt56wer"
user name is "jks4qw"

Can anyone help me to get the regular expression or search query ?

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Try:

... | regex _raw!="user name is \"\*\*\*"
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...